CVE-2015-9423: Improper Neutralization of Input During Web Page Generation

The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simplefieldsfieldtypepostdialogload PlugneditBGColor, PlugneditEditorMargin, plugneditwidth, pnemedcount, or plugneditcontent parameters...

CVE-2015-9420: Improper Neutralization of Input During Web Page Generation

The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=getsoundcloudplayer id parameter...

CVE-2015-9445: Cross-Site Request Forgery (CSRF)

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegalleryajaxaction operation...

PT-2019-14746

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns a CSRF vulnerability in the admin ajax.php endpoint, specifically with the action=savexml and tab=vodplay parameters. This allows for potential unauthorized actions. Recommendations For...

CVE-2015-9394

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=packageaddnew to wp-admin/admin-ajax.php...

CVE-2015-9394

The CVE concerns the WordPress plugin Users Ultra Membership (plugin) before 1.5.63. A CSRF vulnerability exists via action=package_add_new to wp-admin/admin-ajax.php, enabling an attacker to perform actions on behalf of authenticated users. Exploitation details are not provided beyond the CSRF d...

PT-2019-7353

Name of the Vulnerable Software and Affected Versions users-ultra plugin versions prior to 1.5.63 for WordPress Description The issue concerns a CSRF vulnerability. It can be exploited via the action=package add new parameter to the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For...

CVE-2015-9394: Cross-Site Request Forgery (CSRF)

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=packageaddnew to wp-admin/admin-ajax.php...

CVE-2016-10959

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...

CVE-2016-10958

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...

Cross site request forgery (csrf)

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...

Code injection

The newspaper theme before 6.7.2 for WordPress has script injection via tdadsheader to admin-ajax.php...

CVE-2016-10959

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...

CVE-2016-10959

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...

CVE-2016-10958

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...

PT-2019-7752

Name of the Vulnerable Software and Affected Versions Estatik plugin versions prior to 2.3.1 for WordPress Description The issue concerns an authenticated arbitrary file upload, which is also exploitable with CSRF, via the es media images parameter to the "wp-admin/admin-ajax.php" API endpoint...

PT-2019-7751

Name of the Vulnerable Software and Affected Versions Estatik plugin versions prior to 2.3.0 for WordPress Description The issue allows for unauthenticated arbitrary file upload. This is achieved by exploiting the es media images parameter in the "wp-admin/admin-ajax.php" API endpoint...

PT-2019-8547

Name of the Vulnerable Software and Affected Versions Newspaper theme versions prior to 6.7.2 Description The issue concerns script injection via the td adsheader variable to the "admin-ajax.php" endpoint. This allows for malicious script execution. Recommendations For versions prior to 6.7.2,...

CVE-2016-10958: Unrestricted Upload of File with Dangerous Type

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...

CVE-2017-18634: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The newspaper theme before 6.7.2 for WordPress has script injection via tdadsheader to admin-ajax.php...